AI cybersecurity for banks – 5 data security questions

The cybersecurity conversation has changed, and it’s largely down to artificial intelligence. It begins with a solid understanding of what AI cybersecurity is; that is, the combination of data classification, identity and access controls, AI use policies, continuous oversight, and employee safeguards used to prevent sensitive information from being exposed or misused through AI systems.

With AI, there are now many more ways for banks to access, share and deploy the highly sensitive data at their disposal. So, it’s time to rethink how you protect that data from potential misuse.

It is no longer enough to maintain traditional perimeter defenses against external threats. When transformative AI tools and models are active across your banking organization, you also need to look inward at your own internal data controls. Knowledge is power, and the financial institutions that win with AI will be those that can consistently answer the following five questions.

Knowledge is power, and the financial institutions that win with AI will be those that can consistently answer the following five questions.

1. Do you know where your sensitive data lives?

You can’t protect your most sensitive data from unauthorized access if you’re not sure what it looks like or where to find it. That’s why it’s critical to classify all the data your bank creates, accesses or shares based on its sensitivity, and plainly show the level of restriction, confidentiality or protection required.

Typically, highly restricted or confidential data should only be stored in systems or environments whose access your organization controls. Personal cloud services or external devices are out of the question.

2. Can you clearly distinguish which data AI can and cannot access?

AI must be able to retrieve and work with data only when it’s safe to do so, and not when it compromises security. Again, data classification is key, and there must be clear limits on which tools can access which levels of sensitive data.

Additionally, an AI tool should only surface data an individual user already has permission to access. In other words, additional access should never be granted to unauthorized users, regardless of the tool’s own access rights.

3. Are your access controls aligned to risk and regulation?

According to the EU Artificial Intelligence Act, the world's first comprehensive legal framework regulating AI, use cases for AI can generate high, limited or minimal risk. Ultimately the controls, documentation requirements and oversight you apply to each use case should line up with and be proportionate to these classifications.

Banks also need to be certain they are doing all they can to mitigate third-party intellectual property risk with their use of AI. That could mean ensuring the detailed human review and revision of AI-generated content to identify potential issues. Or it may involve following strict development requirements for AI coding assistants to prevent proprietary code from leaking into open-source codebases.

4. Can you protect data throughout its lifecycle?

You must classify your data not only when you create it, but also at every stage of its lifecycle – at rest, in use or in transit, and according to who will receive it and the potential impact on your organization. If the content or context changes, including the application of AI, you should review the classification.

Plus, when multiple data elements are combined, the highest classification applies to the entire set. If data is not explicitly classified, it should be treated as internal by default; that is, intended for general use within the bank but not approved for client or public disclosure.

5. Is cybersecurity embedded into employee decision-making?

Whether your employees are planning to access, store, share or send data, it pays to always stop and think carefully about the next best action. Well-defined data handling standards for your organization should help make decisions that protect your data from cyberrisks.

As a rule of thumb, you should start by identifying the category of data you are working with – e.g., documents and media – and its data classification. Then consider the activity you’re performing – e.g., handling electronic files – and follow the strictest requirement shown in your data handling framework.

Handle data the FIS way

At FIS, we are responsible for protecting both our own data and that of our financial institution clients. Your data doesn’t belong to us, but it is entrusted to our care. As part of our enterprise data governance policy, we have now established a framework for classifying your data based on its level of sensitivity and protection needed in the age of AI. And through our data handling standard, we’ve put in place explicit safeguards for the creation, use, storage, transfer, archive and destruction of data.

We also offer complete end-to-end managed service, which helps your bank securely deploy, govern and optimize internal use of the Microsoft Copilot AI assistant. Now you can rapidly embrace AI and maximize its value to your business while slashing your risk of oversharing sensitive data or breaching governance and regulatory compliance requirements.